Suspicious Filename with Embedded Base64 Commands

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•1•0•3

Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.